Bus Ticket Booking with Seat Reservation < 5.9.5 - Unauthenticated Insecure Direct Object Reference to Booking Cancellation and Status Manipulation via Payment Return Handler

ID

WPSEC-2026-0137

Plugin

Bus Ticket Booking with Seat Reservation (bus-ticket-booking-with-seat-reservation)

Affected

from 5.9.1 before 5.9.5

Remediation

Update to 5.9.5 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness

CWE-639

Usage

Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22

Attack surface

Bus Ticket Booking with Seat Reservation on WPSec AttackSurface

Fix released

2026-09-30

Published

2026-10-01

Description

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 5.9.1 to 5.9.3 (released through the wordpress.org trunk). The handle_payment_return() function of the bundled standalone booking engine runs on init for every front-end request whenever the Pro add-on is inactive, whatever the booking mode. It acted on a user-supplied booking_id and gateway parameter with no signature or ownership check. This makes it possible for unauthenticated attackers to cancel any booking by its numeric ID, including already-paid and WooCommerce-flow bookings, which releases the seats for resale. By supplying gateway=offline, whose verification always succeeds, they could also move unpaid, failed or cancelled bookings to a confirmed (on-hold) status. Status emails are sent in both cases. Version 5.9.0 is not affected. The fix shipped in 5.9.4 and adds an HMAC-signed return URL, an awaiting-gateway check and a gateway taken from stored booking meta.

References

• https://wpsec.com/vuln/WPSEC-2026-0137/
• https://plugins.svn.wordpress.org/bus-ticket-booking-with-seat-reservation/tags/5.9.5/
• https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS